HTC Thunderbolt Full Root and Bootloader Unlock Instructions

Uh Oh, looks like HTC has failed again. For some odd reason all these manufacturers insist on trying to lock down these devices. I think they should just embrace the custom ROM and hacker community. After all it's extremely popular and has totally helped Android become what it is today. I'm just waiting for CyanogenMod Phone One to be released so we don't have to ever worry about rooting ever again. (Happy Face)

The Thunderbolt was one of, if not the most locked down device from HTC to date. Apparently they made signed images, a signed kernel, and a signed recovery. They locked the memory too. As always the developer community has done what they do best, and that is completely take care of all the hard work for you. It is now fully rooted, as well as S-OFF. Fully unlocked. Team AndIRC has been working on this for the last 72 hours almost non stop. So feel free to thank them, or buy them a drink. Now we just have to wait a few weeks and you will all be able to run CyanogenMod 7 and overclock your Thunderbolts to 1.5+ Ghz.

Now I've talked way to long. I'll just go ahead and skip to the good stuff. I must mention that this is NOT for the faint at heart. These instructions are new, and just released. I'm sure easier ways will eventually show up, but for now this is it. Most people that will do this I expect to know what they are doing. As always, take extreme caution with anything in adb. Remember it voids your warranty, and enjoy it. Android Police, or AndroidCommunity hold no responsibility for your actions.

Note that adb is required.
Push misc.img, busybox, and psnueter using the following commands:
adb push psneuter /data/local/

adb push busybox /data/local/

adb push misc.img /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

Step 3

This step will gain temp root and flash the custom misc.img. Run:

adb shell
Now the shell should display "$".

Run:
/data/local/psneuter

You will now be kicked out of adb, and adb will restart as root. Let’s confirm the md5 of misc.img:

adb shell
At this point, the shell should display "#".

Run:
/data/local/busybox md5sum /data/local/misc.img

Output should be "c88dd947eb3b36eec90503a3525ae0de." If it’s anything else, re-download the file and try again.

Now let’s write misc.img:

dd if=/data/local/misc.img of=/dev/block/mmcblk0p17

exit

Step 4

Here you will rename the downgrade RUU as PG05IMG.zip and place it on your SD card. Then, run the following command:

adb reboot bootloader
Choose the bootloader option and press power; let the ROM flash. When asked to upgrade, choose yes. Don’t freak, it’s a long reboot.
Once done, reboot and delete PG05IMG.zip from your SD card.
Set up the two part exploit, to gain root and unlock MMC.
Push wpthis, busybox, and psnueter.

adb push psneuter /data/local/

adb push busybox /data/local/

adb push wpthis /data/local/

adb shell chmod 777 /data/local/psneuter

adb shell chmod 777 /data/local/busybox

adb shell chmod 777 /data/local/wpthis

Step 5

Next, enter the following commands:

adb shell
/data/local/psneuter

To unlock eMMC:
adb shell

/data/local/wpthis

exit

Step 6

Please pay attention – this is very important. This step involves a small chance of bricking if you mess up.

To push the eng bootloader:

adb push hbooteng.nb0 /data/local/

adb shell

/data/local/busybox md5sum /data/local/hbooteng.nb0

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb" exactly, stop, delete it, and re-download it. Otherwise, continue.

Now we will write the new bootloader.

dd if=/data/local/hbooteng.nb0 of=/dev/block/mmcblk0p18

Confirm proper write:

/data/local/busybox md5sum /dev/block/mmcblk0p18

If the output does not match "6991368ee2deaf182048a3ed9d3c0fcb," try again; if it still doesn’t work, seek help from chat.andirc.net in channel #thunderbolt. DO NOT REBOOT.

Now, reboot your phone and put the custom RUU (PG05IMG.zip) on your SD card. Then flash it. This will upgrade you to release firmware with an S-OFF bootloader.

Super excited that the root is here!!! …. BUT I’m coming from the Droid X. This is way more different and complicated than a z4root app lol. I have no conference in my skills to perform this task yet. Definitely gonna wait for a much easier method. Shouldn’t take long. Unrevoked3 should have a easier method in a little while.